dydx[.]airdrpalerts[.]cfd

The domain dydx.airdrpalerts.cfd was registered on October 25, 2025 through Dynadot LLC and is currently taken offline. Infrastructure analysis shows that the domain resolves to the IP address 142.250.181.228, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain uses Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and does not present an SSL certificate, indicating that any HTTP service would be delivered over an unencrypted connection. The page title returned by the web server is "Google," which does not correspond to the advertised brand.

The site is classified as a crypto scam that impersonates the decentralized exchange dYdX. Trust scoring from Gridinsoft assigns a zero out of one hundred, reflecting a high confidence of malicious intent. Two of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked.

While the limited detection footprint suggests early-stage activity, the combination of brand impersonation, low trust score, and confirmed vendor detections warrants elevated risk. Defenders should add dydx.airdrpalerts.cfd and its resolving IP to network deny lists, enforce TLS‑only policies to prevent accidental clear‑text connections, and monitor for re‑registration or similar sub‑domains targeting the dYdX brand. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators.